Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Read original article ↗AI Summary
A critical memory-corruption vulnerability in Google's Brotli decoder, tracked as CVE-2026-11147, affects multiple widely used software platforms including Node.js, Bun, Python (via Brotli and brotlicffi packages), Envoy, Istio, and cdxgen. The flaw allows attackers to trigger buffer overflows via crafted Brotli-compressed data, potentially leading to remote code execution, memory leaks, or crashes. Imperva demonstrated a working exploit on unpatched Node.js, named Node2Shell, achieving remote code execution on Linux ARM64, though no in-the-wild exploitation has been observed. The vulnerability stems from unpatched code in the Brotli C library that went unfixed in releases for months despite being addressed in source code in February 2026.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.